Michael Chan

Father of two boys, guitar and uke player. Identity, GenAI, and security architect. My opinions are my own.

[Michael Chan @mchancloud]

🔐If you ever need to call the AWS IAM or STS APIs, or want a snapshot of your IAM resources (users, roles, and policies), or just want to learn more on IAM's behavior, check out my two-part blog on this topic! https://t.co/O52YOszmbO

[Michael Chan @mchancloud]

It's these types of exploits that make me extra careful when reviewing the security apps that use LLMs.

[Tamir Ishay Sharbat @tamirishaysh]

We got ChatGPT to leak sensitive data from your Google Drive data back to OUR servers. And you’ll never even know it happened.

All by sharing a single document. A real 0-click data exfil attack.

Here’s a detailed breakdown of how we did it 🧵
#DEFCON #BHUSA @mbrg0

[Michael Chan @mchancloud]

@canva If this isn't reflective of your sales culture, then I'd appreciate a DM on how we can resolve this. My job is to review vendors on their AI-related security controls, and up to now all vendors have willingly complied, enterprise version or not. @canva thoughts?

[Michael Chan @mchancloud]

Hey @canva, you told us that you wouldn't answer security questions "without purchase of the Enterprise version". Is this reflective of your attitude towards customers who care about security, privacy, and compliance especially with the concerns everyone has around AI? Do better!

[Michael Chan @mchancloud]

I'd recommend this anyone needed to skill up on AWS IAM!

[Michael Chan @mchancloud]

While not working on ☁️IAM security🔒, I've had to dive in Microsoft Copilot & Copilot Studio security. Copilot Studio is a no/low-code agent and chatbot platform with many integrations to your MS tenant, SNOW, Facebook, etc. Make sure your developers configure this securely!

[Michael Bargury @mbrg0]

a short summary of all new attack vectors, lol techniques and tools we published at bh/dc (400 words)
https://t.co/Odln7W5A9u

[Michael Chan @mchancloud]

A 🪲 bug with Google Search's AI Overview feature? Either way its completely incoherent.... in repudiateas in scowlas in spurnas in turn downas..!

[Arynn Crow @arynncrow]

ICYMI!

[Michael Chan @mchancloud]

Happy holidays everyone! Wishing you all a happy and secure Christmas season. Gingerbread house kit courtesy of @wiz_io and @SolvangBakery.

[Ilya Epshteyn @IlyaEpshteyn]

Awesome to see this in the docs now! Also check out this great session from @colmmacc where he covers FAS: https://t.co/J64HuGhQFK

[Michael Chan @mchancloud]

👉For those who want more on AWS security internals, we finally have a great page describing Forward Access Sessions, the vehicle by which many AWS services does things on behalf of you. https://t.co/A7jiasxqhN @AWSIdentity

[kat traxler @NightmareJS]

As of next year, #google will require premium subscriptions for things like IAM Recommender, Role Insights, etc.
This is the OPPOSITE of their mantra calling for shared fate instead of the shared responsibility model.
A massive loss in credibility.

[Peter C @itspeterc]

Big pricing change to a valuable GCP security feature for least-privilege IAM. Requiring the org-level SCC Premium bundle instead of a pay-as-you-go per-service price will be prohibitively expensive and detrimental to security for many customers in the long run. @philvenables

[Michael Chan @mchancloud]

Shame on you @googlecloud. Your competitor's AWS IAM Access Analyzer is free, and will likely remain so. If you cared about customer security, you're certainly not showing it.

[Michael Chan @mchancloud]

😠Wondering today why @googlecloud charges for security features that @awscloud gives away for free. Shouldn't customer security be paramount?

"What will require Security Command Center Premium:

IAM Recommender, including lateral movement insights, role recommendations ..."

[Michael Chan @mchancloud]

"What will require SCC Premium:

IAM Recommender, including lateral movement insights, role recommendations for non-basic roles, recommendations for custom roles, and recommendation for Google Cloud Storage buckets.
Policy Analyzer at scale (above 20 queries per day)."

[Michael Chan @mchancloud]

@benbridts What direction is that?

[Michael Chan @mchancloud]

Coming from someone reviewing the security controls that can be enabled in Azure, this isn't too comforting. AWS I know has a strong security culture, but much less sure about Microsoft.

[Wiz @wiz_io]

🔒 What happened?

While releasing open-source training datasets, Microsoft's AI research team accidentally left the vault door open 👀

Over 38TB of data (!), including personal backups of employee workstations, private keys, and internal Microsoft Teams messages, were exposed.

[Michael Chan @mchancloud]

Google's use of the vuln list https://t.co/5rXuASm2yy to claim better security than other CSP's is a classic example of misusing statistics by not understanding how the data has been curated and represented. @0xdabbad00

[Michael Chan @mchancloud]

@alexadevs I was owed a May 13th payment, but its after 90 days, and according to your policy my money is now forfeit! I really hope this is not the case. I have upcoming payments as well :| Talking with Alexa support has not helped either.

[Michael Chan @mchancloud]

Hey @alexadevs, my Alexa skill has earned $$ the past few months, but it's never been credited to my bank account even though I've provided the info as asked in the developer console. Can you assist? I hope no other devs have this issue!